Privacy Policy

1. What we collect

• Account info: name, email, and (if you sign in with Google) your Google profile info.
• Content you provide: website descriptions, follow-up answers, uploaded voice recordings (processed for transcription, not stored as audio), generated code and its version history, SEO settings, and any custom domains you connect.
• Billing info: handled directly by Paddle, our payment processor — we don't see or store your card details ourselves.
• Usage data: which features you use and how many credits you spend, kept in a credit ledger and an audit log of security-relevant account events (logins, plan changes, deletions).
• If you connect Vercel: an access token allowing us to deploy on your behalf, until you disconnect it.

2. How we use it

To operate webma: authenticate you, generate and store your websites, process payments, enforce plan limits, provide customer support, and maintain security (including the audit log). We don't sell your data.

3. Who we share it with

Only the processors needed to run the service:

• Supabase — hosts our database and handles authentication.
• Anthropic (Claude), Groq, Cerebras, and OpenRouter — process your website descriptions and edit instructions to generate and modify content. Your prompts may be cached (as a task+prompt hash, not linked to your identity) to avoid re-billing identical requests. See our AI use disclosure for which provider handles which task.
• Groq (Whisper) — transcribes voice recordings you record for the AI prompt; audio is processed for transcription and not stored by us.
• OpenAI — generates AI images when you use that feature.
• Paddle — processes payments and, as merchant of record, handles applicable sales tax/VAT. See Paddle's own privacy policy for how they handle payment data.
• Vercel — host deployed sites, either under our platform account or yours if you've connected one.

We don't share your data with anyone else, except where required by law. Full list with what each processor does: Subprocessors.

4. Your rights

You can view and update your profile info from your account settings. You can download a copy of your own data (profile, projects, subscriptions, payment history) at any time from Settings → Export your data. You can permanently delete your account — including all projects, subscription data, and connected integrations — at any time from Settings; this is irreversible. If you're in a jurisdiction with statutory data rights (GDPR, CCPA, or similar), you may also have a right to object to certain processing — contact us to exercise these.

5. Data retention

We keep your account and project data for as long as your account is active. Audit log entries (security-relevant events) are retained separately for accountability purposes even after related records change. Deleting your account removes your projects, subscription, and connections; some records may be retained where we're legally required to (e.g. payment records for tax purposes, handled by Paddle).

6. Security

We use row-level security so your data is only ever accessible to your own account (or an administrator, for support purposes) at the database level, encrypted connections throughout, and optional two-factor authentication you can enable from Settings.

7. Cookies

We use essential cookies for authentication (session management via Supabase Auth) and a short-lived (7-day) cookie to remember a referral code between visiting a referral link and finishing signup. Our own visitor/page-view analytics don't use cookies at all — visits are counted from a salted, one-way hash of IP address and browser, never linked back to an individual. We don't use tracking or advertising cookies. See our Cookie Policy for the full list.

8. Changes to this policy

We may update this policy from time to time; material changes will be communicated before they take effect.

9. Contact

Questions or data requests: techtig9@gmail.com